Kiteworks Core EUVD-2026-90309

Exploitable ONLY while the Kiteworks Core appliance is in its initial first-time activation window and not yet fully configured - the vulnerable setup endpoint is not reachable once activation completes. Within that window, no authentication, credentials, or user interaction are required: an unauthenticated network attacker can repeatedly re-trigger the privileged activation process because the endpoint enforces neither authentication (CWE-306) nor its intended state precondition. The primary LIMITING factor is this one-time, transient deployment state (reflected as AC:H), which sharply narrows the opportunity to newly-deployed or re-provisioned appliances; impact is confined to integrity/setup disruption with no confidentiality exposure, no code execution, and no persistent takeover.

This is a genuine but narrowly-scoped issue that ranks LOW-to-MEDIUM in practical priority despite the network-unauthenticated vector. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N, 5.9 medium) shows the attractive signals - remote, no authentication, no user interaction - are offset by AC:H, which correctly captures that the vulnerable endpoint is only reachable during the transient first-time activation window before the appliance is fully configured. Impact is integrity-only (I:H): the attacker can repeatedly re-trigger the privileged activation process and leave the appliance incompletely configured, but there is no confidentiality loss (C:N), no described availability/DoS outcome credited (A:N), and no code execution or configuration takeover. There is no EPSS score, no CISA KEV listing, and no public POC, so all exploitation signals point to 'no public exploit identified at time of analysis' rather than active or imminent exploitation. No SSVC decision data was supplied. The signals are internally consistent - network reachability is real but gated by a one-time deployment state - so this is a legitimately-rated medium, not a high-CVSS-but-inflated issue. The 'Authentication Bypass' tag is consistent with the CWE-306 (Missing Authentication) root cause. Note the affected-version metadata is mixed across sources: EUVD lists core <9.5.1 while the sibling setup-interface CVEs in this batch split between 9.5.0 and 9.5.1 fixes - verify the exact fixed build with the vendor advisory.

While a newly-deployed Kiteworks appliance is being activated for the first time and is not yet fully configured, an unauthenticated attacker with network reach to the setup endpoint sends repeated requests that re-trigger the privileged activation process. Because the endpoint enforces neither authentication nor its intended state precondition, the repeated invocations disrupt the setup flow and strand the appliance in an incompletely-configured state. No public exploit code is known, and the attacker must strike during the narrow initial-activation window (AC:H).